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REMARKS 

Claims 1-17, 19 ? 21, and 22 are pending. Claims 1, 12, 15, and 19 are amended. 
Claims 18 and 20 are canceled. Claims 21 and 22 are added. Reconsideration of the 
claims is respectfully requested in view of the following remarks. 

L 35 U.S.C, § 112, Second Paragraph, Alleged Indefimteness of Claims 1-20 

The Office rejects claims 1-20 under 35 U.S.C. § 1 12, second paragraph, as 
allegedly being indefinite for failing to particularly point out and distinctly claim the 
subject matter that Applicants regard as the invention. 

More particularly, the Office Action alleges that the term "active entity' 7 in claim 
1 is indefinite, because Applicants intend the term to mean "human being or legal entity," 
while the accepted meaning is "an object that performs an action." Claim 1, as well as 
independent claims 12 and 15, is amended to recite *Svherein each of the active entities is 
a human being or legal entity." Therefore, claims 1-3 and 12-20 are amended to 
particularly point out and distinctly claim the subject matter that Applicants regard as the 
invention. 

With respect to claim 5, the Office Action alleges that claim 5 is indefinite 
because the claim recites a potential" and fails to identify the specific steps in which an 
information process could be improved. Applicants respectfully disagree. As pointed out 
in the Office Action, claim 5 recites "identifying at least one way in which said 
information-handling process could be improved." The claim does not recite a way in 
which information-handling processes could potentially be improved; rather, claim 5 
recites identifying a way in which information-handling processes could be improved. 
That is, claim 5 does not recite a potential, but recites identifying a potential. The claim 
need not recite each and every "potential" for the scope of the identifying step to be 
definite. This is an issue of breadth, not definiteness. 

Claims 4 and 6-1 1 are not addressed in the body of the rejection. Applicants 
submit that these claims were included in the statement of the rejection by mistake. 

Therefore, Applicants respectfully request withdrawal of the rejection of claims 1- 
20 under 35 U.S.C. § 112, second paragraph. 
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IL 35 U.S.C. § 103, Alleged Obviousness of Claims 1-20 

The Office Action rejects claims 1-20 under 35 U.S.C. 1 03(a) as being allegedly 
unpatentable over Martin, "Principles of Object Oriented Analysis and Design," Prentice 
Hall, 1 993 . Applicants note that the statement of the rejection does not mention 
Birnbaum (presumably U.S. Patent No. 5,797,128); however, the body of the rejection of 
claims 1-3 and 12-20 relies heavily on the teachings of Birnbaum. Applicants assume 
that the Examiner mistakenly omitted Birnbaum from the statement of the rejection. 
However, Birnbaum is not relied upon in the body of the rejection of claims 4-11. 
Therefore, presumably, claims 4-1 1 are only rejected as allegedly being unpatentable 
over Martin. Yet, the Office Action states that claim 10 is rejected for the same reasons 
as claim 2 and claim 1 1 is rejected for the same reasons as claim 3. Thus, even though all 
claims are listed in the same statement of rejection, the same references are not applied to 
all of the listed claims. 

To further advance prosecution, Applicants presume that claims 1-3 and 10-20 are 
rejected as allegedly being unpatentable over Martin in view of Birnbaum and that claims 
4-9 are rejected as allegedly being unpatentable over Birnbaum alone. 

IIA. 35 U.S.C. S 103, Alleged Obviousness of Claims 4-9 

The Office Action presumably rejects claims 4-9 under 35 U.S.C. 103(a) as being 
allegedly unpatentable over Martin, "Principles of Object Oriented Analysis and Design,'* 
Prentice Hall, 1993. This rejection is respectfully traversed. 

Independent claim 4 recites a particular method in which an initial assessment of 
an information-handling process is performed, a model of the information-handling 
process is constructed based on the initial assessment, and output is provided based on 
the initial assessment and constructing, that identifies at least one way in which 
personally identifiable information could be better handled. The Office Action alleges 
that Martin teaches providing output, based on an initial assessment, and constructing a 
model of an information handling process, which identifies at least one way in which 
personally identifiable information may be better handled simply because Martin teaches 
the use of CRC cards at pages 187-190. 
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Martin mentions the use of CRC cards, which are physical index cards used by 
programmers to represent classes in an object oriented model, and the desire of 
programmers to "think like an object." Nowhere in Martin is there any teaching or 
suggestion of a methodology in a data processing system for analyzing an information 
handling process, constructing a model of the information handling process, or generating 
an output that identifies at least one way in which personally identifiable information can 
be better handled by the information handling process, as recited in claim 4, To the 
contrary, Martin merely describes, in general, a manual, index card based technique by 
which programmers may try to gain some insight into how the classes and objects of an 
object oriented model may operate. Martin does not teach anything regarding personally 
identifiable information, handling personally identifiable information, or performing an 
assessment, constructing a model, or determining an improvement to a personally 
identifiable information handling process. 

Moreover, nowhere in Martin is there any teaching or suggestion regarding 
representing entities, data, and rules in an information handling process by using a 
limited number of object classes, representing operations performed on data by using a 
limited number of privacy-related actions, and representing transactions by using the 
limited number of object classes and the limited number of privacy-related actions. The 
Office Action alleges that these features are taught by Martin at page 1 9, 140, 146-147, 
156, and 166. Page 19 of Martin merely teaches that "operations" are used to read or 
manipulate data of an object Page 1 9 does not teach anything regarding privacy-related 
actions or representing transactions using such privacy related actions. Page 140 of 
Martin merely teaches WHEN- IF-THEN trigger rules. Nowhere on page 140 is there any 
teaching or suggestion regarding privacy related actions or using privacy related actions 
along with objects representing entities, data, and rules to represent transactions. 

Pages 146-147 of Martin have been addressed above with regard to claim 1. 
These pages of Martin merely provide example diagrams of rules liked to object oriented 
CASE diagrams. Nowhere in any of the diagrams provided on pages 146-147 is there 
any teaching or suggestion regarding representing objects performed on data as a limited 
number of privacy-related actions or using such privacy-related actions along with 
objects representing entities, data and rules to represent transactions. 
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Similarly, pages 156 and 166 of Martin do not provide any teaching or suggestion 
regarding these features* Page 156 of Martin provides an example object-relationship 
model for students and classes. Again, there is no teaching or suggestion regarding 
representing objects performed on data as a limited number of privacy-related actions or 
using such privacy-related actions along with objects representing entities, data, and rules 
to represent transactions. Page 1 66 of Martin provides an event diagram example, which, 
again, has nothing to do with these features of claim 4. While Martin provides teachings 
regarding some basic building blocks of object oriented environments, Martin does not 
provide any of the specific features recited in claim 4. 

In view of the above, Applicants respectfully submit that Martin does not teach or 
suggest the features recited in claim 4, At least by virtue of their dependency on claim 4, 
dependent claims 5-9 are not rendered obvious by Martin. 

With regard to dependent claim 5, Martin does not leach providing output 
comprises identifying at least one way in which an information handling process can be 
improved. The Office Action alleges that this feature is taught by Martin at pages 1 87- 
190, because Martin teaches using CRC cards to gain a better understanding of how to 
handle the object model. The use of CRC cards is addressed above with regard to claim 
4. Using CRC cards, which, again, are physical index cards that a programmer may use 
as a tool to understand how objects work with each other, does not provide any output 
that identifies at least one way in which an information handling process can be 
improved. A human being, using physical cards, does not constitute a data processing 
system that provides an output. Thus, the whole premise of the rejections based on the 
use of CRC cards is fatally flawed. Nowhere in the Martin reference is there any 
teaching or suggestion to automate CRC cards such that a data processing system uses 
such CRC cards to generate an output that identifies a way in which an information 
handling process can be improved. While CRC cards may be a nice tool for 
programmers to use, it does not obviate the features of claim 5. Thus, in view of the 
above, Applicants respectfully submit that Martin does not teach or suggest the features 
of claim 5. 

The Office uses the same flawed reasoning in rejecting claims 6, 7, and 9. Claim 
6 recites that providing output further comprises identifying at least one way to improve 
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compliance with a law or contract. Just as CRC cards do not teach or suggest providing 
an output that comprises at least one way in which an information handling process can 
be improved (claim 5), CRC cards do not provide any teaching or suggestion regarding 
providing an output that identifies a way to improve compliance with a law or contract 

Claims 7 and 9 are rejected "for the same reasons as claim 5." Claim 7 recites 
enforcing compliance with a law or contract. This feature is not taught or suggested by 
the use of CRC cards. Claim 9 recites that designing a modification further comprises 
designing a modification to improve compliance with a law or contract governing an 
information handling process. Again, using CRC cards does not teach or suggest 
designing a modification that improves compliance with a law or contract governing an 
information handling process. Thus, in view of the above, Applicants respectfully submit 
that Martin does not teach or suggest the features in claims 5 3 6, 7, and 9. 

Regarding claim 8, Martin does not teach or suggest designing a modification to 
an information handling process based on constructing a model and providing output that 
identifies at least one way in which personally identifiable information could be better 
handled. The Office Action alleges that this feature is taught by Martin because Martin 
supposedly teaches that ''modifications are constantly being designed in the creation of 
the object oriented model of the system from the creation of the model, to the creation of 
its design, to the generation of the code" at page 60. All this teaches is that the object 
oriented model may undergo many modifications. Where does this teach anything 
regarding devising a modification based on constructing the model and providing an 
output that identifies at least one way in which personally identifiable information could 
be handled? Once again, the Office takes a general statement in Martin and alleges that 
this general statement teaches a very specific feature recited in the claims without any 
support whatsoever. 

Applicants agree that object oriented models do undergo many modifications 
during their creation. This is not what Applicants are claiming. Rather, Applicants are 
specifically claiming the designing of a modification to an information handling process 
based on constructing a model and providing output that identifies at least one way in 
which personally identifiable information could be better handled. Such a feature is 
not taught or suggested by merely stating that object models undergo many 
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modifications. Thus, in view of the above, Applicants respectfully submit that Martin 
does not teach or suggest the features of claim 8. 

Therefore, Applicants respectfully request withdrawal of the rejection of claims 4- 
9under35U.S.C § 103. 

IIB. 35 U.S.C. S 103. Alleged Obviousness of Claims 1-3 and 10-20 

The Office Action presumably rejects claims 1 -3 and 10-20 under 35 U.S.C. 
103(a) as being allegedly unpatentable over Martin, "Principles of Object Oriented 
Analysis and Design," Prentice Hall, 1993, in view of Birnbaum (U.S. Patent No. 
5,797,128). This rejection is respectfully traversed. 

Claim 1 reads as follows: 

1 . A method, in a data processing system, for handling personally 
identifiable information, said method comprising: 

providing, in a computer, a first set of object classes representing 
active entities in an information-handling process, wherein a limited 
number of privacy-related actions represent operations performed on data 
and wherein each of the active entities is a human being or legal entity; 

providing, in said computer, a second set of object classes 
representing data and rules in said information-handling process, wherein 
at least one object class has said rules associated with said data, and 
wherein said data represents said personally identifiable information; and 

processing transactions, in the data processing system, involving 
said personally identifiable information, using said computer and said first 
and second set of object classes, so as to enforce a privacy policy, 
associated with the personally identifiable information and defined by said 
rules, against one or more active entities represented by said first set of 
object classes, wherein each of the one or more active entities represented 
by said first set of object classes is a human being or legal entity, wherein: 

a first active entity represented by a first object class in said first 
set of object classes is a first data user that requests said personally 
identifiable information from a data subject that is a second active entity 
represented by a second object class in said first set of object classes, 

said data subject is an active entity that is personally identifiable 
by said personally identifiable information; 

a third active entity represented by a third object class in said first 
set of object classes is a second data user that requests personally 
identifiable information from said first data user, and 

said rules define if and how said personally identifiable 
information maybe provided, by said first data user, to said second data 
user, [emphasis added] 
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Martin does not teach or suggest every element of the claimed invention. Specifically, 
Martin does not teach or suggest a first set of object classes representing active entities in 
an information handling process, a second set of object classes representing data and 
rules in an information handling process, or processing transactions involving personally 
identifiable information so as to enforce a privacy policy associated with the personally 
identifiable information and defined by rules of the second set of object classes, against 
one or more active entities represented by the first set of object classes, as recited in 
claim 1. 

Martin is a textbook that is concerned with describing the basic building blocks of 
object-oriented modeling. As such, Martin generally teaches objects, classes, rules, and 
the like. However, Martin does not provide any teaching or suggestion regarding the 
specific arrangement of objects, classes, and rules, or the processing of transactions using 
such arrangement of objects, classes, and rules so as to enforce a privacy policy, 
associated with personally identifiable information and defined by rules in a set of object 
classes, against one or more active entities represented by a first set of object classes. 
Nowhere in Martin is there any teaching or suggestion regarding a first set of object 
classes representing active entities in an information handling process. Nowhere in 
Martin is there any teaching or suggestion regarding a second set of object classes 
representing data and rules in an information handling process. Nowhere in Martin is 
there any teaching or suggestion to process transactions involving personally identifiable 
information so as to enforce a privacy policy associated with the personally identifiable 
information and defined by rules o the second set of object classes, against one or more 
active entities represented by the first set of object classes. 

The Office Action alleges that Martin teaches the feature of "providing, in a 
computer, a first set of object classes representing active entities in an information- 
handling process, wherein a limited number of privacy-related actions represent 
operations performed on data" at page 19, because, in the Examiner's opinion, the objects 
are active entities themselves and that privacy related actions are the operations to read 
and manipulate data of the object. The Examiner explains that . .it is the Examiner's 
position that an object as disclosed by Martin, in the field of Object oriented program, 
inherently discloses an active entity." 
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Claim 1 recites lt wherein each of the active entities is a human being or legal 
entity." Thus, an "active entity* 1 shall be limited to human beings or legal entities. Claim 
1 recites that the first set of object classes represents active entities "in an information- 
handling process"; thus, this feature is to be interpreted as a first set of object classes 
representing human beings or legal entities in an information-handling process. 
Therefore, the first set of object classes do not refer to any object that is involved in 
information handling, as the Examiner alleges. To the contrary, the first set of object 
classes specifically represents human beings or legal entities, i.e. active entities, in an 
information-handling process. An example of such human beings or legal entities is 
given on page 10, line 28, to page 1 1, line I, of the present specification where it states 
that the "main actors in EPA are a data subject 301 (i.e. the person who is described by 
the PII) and one or more data users, 303 or 304 (e.g. different organizations or 
individuals)." Thus, the general objects described in Martin do not teach or suggest using 
a first set of object classes to represent human beings or Legal entities, i.e. active entities, 
in an information-handling process. 

In addition to the above, Martin does not teach or suggest a second set of object 
classes representing data and rules in said information-handling process, wherein at least 
one object class has said rules associated with said data, and wherein said data represents 
said personally identifiable information. The Office Action alleges that this feature is 
taught by Martin at page 144 in the section entitled "Object Structure Analysis/Object 
Behavior Analysis" because this section allegedly states that objects are capable of 
representing data and rules in their interrelationships with other objects. While it may be 
true that objects are capable of representing data and rules, there is nothing in such a 
general teaching that teaches or suggests using object classes to represent personally 
identifiable information in association with rules, as recited in claim L Nowhere in 
Martin is there any mention of using objects to represent personally identifiable 
information in association with rules in an information handling process. Moreover, 
there is no teaching or suggestion in Martin to use a first set of object classes representing 
active entities in an information handling process and use a second set of object classes 
representing personally identifiable information and rules in an information handling 
process. 
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Further to the above, Martin does not teach or suggest processing transactions 
involving personally identifiable information using the first set of object classes and the 
second set of object classes so as to enforce a privacy policy, associated with the 
personally identifiable information and defined by the rules, against one or more active 
entities represented by the first set of object classes. The Office Action alleges that 
Martin teaches processing transactions involving personally identifiable information 
using a first set of object classes and a second set of object classes in the diagrams on 
pages 146-147 of Martin. Specifically, the Office Action alleges that the identities of the 
customers, their salaries, employee types, etc. are personally identifiable information. 
While these may be examples of personally identifiable information, there is no teaching 
or suggestion in the diagrams on pages 146-147 of Martin to enforce a privacy policy 
associated with personally identifiable information, represented in a second set of object 
classes, against one or human beings or legal entities represented by a first set of object 
classes. The diagrams shown on pages 146-147 of Martin have nothing to do with a 
privacy policy, let alone a privacy policy that is defined by rules in a second set of object 
classes, associated with personally identifiable information in the second set of object 
classes, which is applied against a first set of object classes that represent human beings 
or legal entities in an information handling process. 

The Office Action acknowledges that Martin does not teach a first and second set 
of object classes that enforce a privacy policy. The Office Action alleges that Birnbaum 
teaches that policies are defined to be rules for the values of the attributes of managed 
objects. Claim 1 is amended to incorporate the features previously presented in claim 18. 
Thus, in claim 1 there is a data subject that is personally identifiable by the personally 
identifiable information, a first data user that requests the personally identifiable 
information from the data subjects a second data user that requests the personally 
identifiable information from the first data user, and rules that govern if and how the 
personally identifiable information may be provided by the first data user to the second 
data user. None of these features is taught or suggested by Martin or Birnbaum. 

The Office Action alleges that these features are taught by Martin in Figure 11.13 
and its corresponding description. Specifically, the Office Action states that a first active 
entity is a student represented by a person object that requests personally identifiable 

Page 17 of 21 
Adleret al. - 09/884,311 

PAGE 19/23 " RCVD AT 3/15/2006 11:42:43 AM [Eastern Standard Time] * SVR:USPTO-EFXRF<J/0 * DNIS: 2738300 * CSID: 214 722 6533 * DURATION <mm-s$): 10-48 



MHR" 15 2006 10:4GRM URLDER INTELLECTUAL PROPE 214-722-6533 



p. 20 



information from a data subject, wherein the personally identifiable information is a 
registration. Conspicuously missing from the Examiner's explanation of how Figure 
11.13 supposedly teaches all of the features of previously presented claim 18 is any 
explanation of where in the figure the second data user is represented. That is because 
Figure 11.13 has nothing to do with the features of previously presented claim 1 8 and the 
Examiner is attempting to force Figure 1 1 . 13 to fit the mold of claim 1 8 (now claim 1) 
using hindsight 

Nowhere in Figure 1 1.13 or its corresponding description is there any teaching or 
suggestion regarding one data user requesting information from another data user about a 
data subject where rules govern if and how the information may be provided by the first 
data user to the second data user. The Examiner points to a seemingly arbitrary and 
irrelevant portion of the Martin reference. Figure 1 1 . 13 is actually an event diagram 
illustrating a registration event in which a student registers, a dormitory room is obtained, 
and the student is invoiced. This has nothing to do with the features of previously 
presented claim, which are now recited in claim 1. 

Independent claims 12 and 15, as amended, provide system and computer-usable 
medium claims having features that are similar to those discussed above with regard to 
claim 1 . Therefore, these claims are distinguished over Martin and Birnbaum for similar 
reasons as set forth above with regard to claim 1 . 

In view of the above, Applicants respectfully submit that Martin and Birnbaum, 
taken alone or in combination, do not teach or suggest the features recited in claims 1,12, 
and 15. At least by virtue of their dependency on claim 4, dependent claims 2-3, 13-14, 
and 1 6-20 are not rendered obvious by Martin and Birnbaum. 

The rejection of the dependent claims is respectfully traversed for at least the 
same reasons set forth above with regard to claims 1, 12 and 15, from which claims 3, 14 
and 17 depend, respectively. In addition, Applicants respectfully traverse the Examiner's 
taking of Official Notice that representing rules as a filled paper form, including both 
collected data and rules regarding said collected data, was well known in the art at the 
time of the invention. While electronic forms may have been generally known, 
associating rules with data collected by such electronic forms in said electronic forms, 
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specifically as recited in combination in claims 3, 14, and 17, was not know prior to 
Applicants* claimed invention. 

In response to this argument, the Examiner states that examples of an object class 
representing a filled paper form including both collected data and rules regarding the 
collected data include contracts signed by parties. The Examiner states that a common 
example of this feature is a legal contract, such as the contract for sale of a house, which 
involves the collection of data and would thereby form the set of rules to apply to the 
collected data. Applicants respectfully disagree. 

While these examples that the Examiner provides are all good examples of paper 
forms, they are not object classes that represent a filled paper form having collected data 
and rules regarding the collected data. Nowhere in the example of a paper contract is 
there any teaching or suggestion to represent such a paper contract as at least one object 
class having collected data and rules regarding collected data. 

Moreover, the Examiner's allegation that the legal contract includes collected data 
and rules regarding the collected data is simply incorrect. While legal contracts do have 
information that is filled into them, the content of the contract does not regard the 
information that is filled in, but rules to be applied to the subject of the contract. For 
example, inserting the address of the house that is the subject of the sale does not mean 
that the "rules" in the contract apply to the address information that was entered. To the 
contrary, the rules in the contract apply to the parties involved in the sale. Nowhere in 
the sale contract is there any rule regarding how the information filled into the contract 
may be used. Thus, the Examiner's allegation is completely without merit. 

Moreover, even if electronic forms having collected data and associated rules 
were known prior to Applicants' invention, there is no teaching or suggestion to include 
such a feature in the mechanisms of Martin and/or Birnbaum. As discussed previously, 
Martin is merely a general textbook describing the basic building blocks of object- 
oriented models. Martin does not provide any teaching or suggestion of any problem for 
which electronic forms having collected data and associated rules would be a solution. 
The only basis for asserting such a combination is a hindsight reconstruction of 
Applicants' claimed invention -using Applicants' own disclosure to provide the 
suggestion for making the combination. Such a combination, predicated on knowledge of 
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Applicants' claimed invention, is impermissible as a basis for establishing a prima facie 
case of obviousness* 

Furthermore, even if such a combination were possible and there were a 
suggestion in Martin or Birnbaum to include such electronic forms with collected data 
and associated rules, the result still would not be the invention as recited in claims 3,14 
and 17. As discussed above, Martin and Birnbaum do not provide any teaching or 
suggestion regarding the features of independent claims 1,12, and 15, The inclusion of 
an electronic form with collected data and associated rules would not provide for this 
deficiency in Martin, as combined with Birnbaum. Thus, the combination still would not 
result in the invention as recited in claims 3, 14, and 17. In view of the above, Applicants 
respectfully submit that Martin and Birnbaum, taken individually or in combination, do 
not teach or suggest the features recited in dependent claims 3, 14, and 17. 

Dependent claims 19, 21, and 22 recite transforming, based on the rules, 
personally identifiable information into a depersonalized format prior to providing the 
personally identifiable information to the second data user. The Office Action alleges 
that this feature is taught by Martin at page 166. The Office Action alleges that the 
registration information is a depersonalized format, but is specific to a particular student 
when a student makes the registration. Applicants respectfully disagree. 

As set forth in the present specification on page 13, lines 6-9, depersonalized data 
is personally identifiable information where the link to the data subject is not visible and 
cannot be established without knowing some additional information. A registration of a 
student is not depersonalized information. To the contrary, the registration requires that 
the student be identifiable from the information. Thus, the Examiner's allegations in the 
Office Action are simply incorrect. Once again, the Examiner randomly selects portions 
of the Martin reference and attempts to force them into the mold of the present claims 
regardless of the fact that they simply do not have anything to do with the present claims. 
Nowhere in Martin, or Birnbaum, is there any teaching or suggestion to transform 
personally identifiable information into a depersonalized format prior to providing the 
personally identifiable information to a second data user. In view of the above, 
Applicants respectfully submit that Martin and Birnbaum, taken alone or in combination, 
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do not teach or suggest the features of dependent claim 19, or those of new claims 21 and 



Therefore, Applicants respectfully request withdrawal of the rejection of claims 1- 
3, 10-17, and 19 under 35 U.S.C. § 103. 

III. Conclusion 

It is respectfully urged that the subject application is now in condition for 
allowance. The Examiner is invited to call the undersigned at the below-listed telephone 
number if in the opinion of the Examiner such a telephone conference would expedite or 
aid the prosecution and examination of this application. 



Respectfully submitted, 



DATE: March 15. 2006 




Reg. No. 41,534 

Walder Intellectual Property Law, P.C. 
P.O. Box 832745 
Richardson, TX 75083 
(214) 722-6419 

ATTORNEY FOR APPLICANTS 
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